CVE-2026-104446: YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler
YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient, sender, subject and body for spam and phishing.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
YesWiki installations running a version before 4.6.7 are affected if their contact mail AJAX handler can use the wiki's configured SMTP server. The attacker does not need an account or prior authentication.
What does an attacker need to exploit it?
An attacker can send an XMLHttpRequest POST to the contact mail handler without field or type parameters. They can supply arbitrary recipient, sender, subject, and body values to send messages through the server.
What is the likely impact of successful exploitation?
The affected SMTP server can be abused as an open relay for spam and phishing messages. The provided impact information indicates integrity and availability effects, with no confidentiality impact listed.
How can I tell whether my instance is vulnerable?
Check the installed YesWiki version. Versions before 4.6.7 are affected according to the available information.